DragonFlyBSD Kernel Audit
DF-0524 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/netgraph/fec/ng_fec.c b/sys/netgraph/fec/ng_fec.c
--- a/sys/netgraph/fec/ng_fec.c
+++ b/sys/netgraph/fec/ng_fec.c
@@ -406,6 +406,10 @@
 
 	/* Add to the queue */
 	new->fec_if = bifp;
+	/* DF-0524: DragonFly has no if_ref()/if_rele(). The stored raw pointer
+	 * becomes dangling if the member interface is detached. Proper fix:
+	 * register an ifnet_detach_event EVENTHANDLER to NULL out fec_if on
+	 * interface removal, and check fec_if != NULL before dereferencing. */
 	TAILQ_INSERT_TAIL(&b->ng_fec_ports, new, fec_list);
 
 	ifnet_unlock();